Retailers Overconfident in Security Controls

Tripwire announced the results of a retail cybersecurity survey conducted by Dimensional Research and sponsored by Tripwire. The survey evaluated the attitudes of 154 retail organizations on a variety of cybersecurity topics.

Industry research indicates most breaches go undiscovered for weeks, months or even longer. The 2014 Trustwave Global Security Report reveals that retail is the top target for cybercriminals, comprising 35 percent of the attacks studied.

The Mandiant 2014 Threat Report indicates that the average time required to detect breaches was 229 days. The report also states that the number of firms that detected their own breaches dropped from 37 percent in 2012 to 33 percent in 2013.

Despite these findings, U.S. retail firms are confident in their ability to detect data breaches, according to the Tripwire survey. When asked how quickly their organizations would detect a breach, 42 percent said it would take 48 hours, 18 percent said it would take 72 hours, and 11 percent said it would take a week.

Thirty-five percent of respondents were “very confident,” while 47 percent were “somewhat confident” that their security controls could detect rogue applications such as those used to exfiltrate data during data breaches.

“I always say that trust is not a control, and hope is not a strategy. Unfortunately, this data suggests that a lot of retailers are far too hopeful about their own cybersecurity capabilities” said Dwayne Melancon, chief technology officer for Tripwire.

“Despite ample historical evidence that most breaches go undiscovered for months, there is clearly a significant disconnect between perception and reality, even though the repercussions for failing to meet the required level of rigor around cybersecurity has led to the recent removal of retail executives and board members.”

Other key findings include:

70 percent of respondents said that the recent Target breach has affected the level of attention executives give to security in their organizations.

Online-only retailers were less concerned with the Target breach; only 57 percent said it has increased the level of executive attention.

26 percent of respondents don’t evaluate the security of business partners, such as HVAC contractors who were implicated in the Target breach.

Melancon continued: “On the bright side, recent events have led to higher-level conversations about information security in the retail sector. This is a prime opportunity for retail information security executives to educate their nontechnical peers, advocate for resources and make substantive progress toward better information security.”